Re:Maintaining Digital Certificate Security
by yuhong on Monday March 23, 2015 @08:34PM
(#9254232)
Unlikely and would cause problems. Parent was suggesting that they should be cleared separately without having to update browsers. I like the certificate transparency idea better though, and I wonder if it is possible to refuse new certs via public endpoints but allow certs to be manually added to the logs and SCTs to be manually issued, in case going that far is needed.
[ Parent
| on HN ]
Re:Maintaining Digital Certificate Security
by JoshTriplett on Monday March 23, 2015 @08:36PM
(#9254239)
What problems, precisely? Sure, it would prevent current CAs from selling sub-CA certificates without coordinating with browser vendors. That's the point. What's a legitimate use case for doing so?
Yes, but the point is that this "coordinating" can be done without users having to update browsers themselves.
Re:Maintaining Digital Certificate Security
by JoshTriplett on Monday March 23, 2015 @08:52PM
(#9254295)
All the major browsers have automatic updates these days. And if the coordination doesn't include a browser whitelist, it has no teeth.